KR101381558B1 - Method for detecting anomaly traffic and apparatus thereof - Google Patents

Abstract

An abnormal traffic detection method and apparatus are disclosed. According to an embodiment of the present invention, there is provided a method of generating a graph representing network traffic, calculating a static variable representing a traffic characteristic at a specific time point and a dynamic variable representing a traffic characteristic changing over time based on the graph. Detecting abnormal traffic according to a result of comparing at least one of the static variable and the dynamic variable with a predefined threshold value. Therefore, abnormal traffic can be detected accurately and quickly, and the time spent in determining the type of abnormal traffic can be reduced.

Description

Anomaly traffic detection method and apparatus {METHOD FOR DETECTING ANOMALY TRAFFIC AND APPARATUS THEREOF}

The present invention relates to an abnormal traffic detection technique, and more particularly, to a method and apparatus for detecting abnormal traffic for detecting abnormal traffic caused by a network attack.

As the transmission of traffic through the Internet increases, the importance of network security for detecting abnormal traffic and responding to the detected abnormal traffic is increasing. Abnormal traffic may be caused by various causes such as Denial of Service (DoS), port scan, Internet worm, etc., and such abnormal traffic severely affects the normal functioning of the network. Therefore, abnormal traffic detection is an important factor that cannot be excluded from network security.

However, detecting and identifying threats that cause abnormal traffic is not easy. The anomalous traffic detection techniques used to date have been based primarily on machine learning, data mining, and statistical analysis, but these techniques can be very time consuming or often produce incorrect analysis results. Therefore, a new technique is needed to compensate for this.

An object of the present invention for solving the above problems is to provide an abnormal traffic detection method for detecting abnormal traffic based on the traffic distribution graph.

Another object of the present invention for solving the above problems is to provide an abnormal traffic detection method for detecting abnormal traffic based on the traffic distribution graph.

Abnormal traffic detection method according to an embodiment of the present invention for achieving the above object, generating a graph representing the network traffic, the static variable representing the traffic characteristics at a specific time point based on the graph and changes over time Calculating a dynamic variable indicative of a traffic characteristic and detecting abnormal traffic according to a result of comparing a predetermined threshold with at least one of the static variable and the dynamic variable.

The abnormal traffic detection method may further include determining a type of abnormal traffic by applying a graph matching algorithm when abnormal traffic is detected.

Here, the generating of the graph may generate a traffic distribution graph using the graph.

The calculating of the dynamic variable representing the traffic characteristic may include calculating an adjacent matrix based on a connection relationship between nodes included in the traffic distribution graph, and calculating the static variable and the dynamic variable based on the adjacent matrix. It may include the step of calculating.

The calculating of the static variable and the dynamic variable may include calculating the maximum traffic among the traffic for the node as the static variable and associating the at least two traffic dispersion graphs that are continuous over time with the dynamic variable. It can be calculated as

Abnormal traffic detection apparatus according to an embodiment of the present invention for achieving the above another object, generates a traffic distribution graph indicating the network traffic, and a static variable and time indicating the traffic characteristics at a specific time point based on the traffic distribution graph A processor for detecting abnormal traffic according to a result of calculating a dynamic variable representing a traffic characteristic changing according to the comparison and comparing a predetermined threshold value with at least one of the static variable and the dynamic variable, It may include a storage unit for storing at least one of the static variable, the dynamic variable and the threshold value.

Here, the processor is configured to calculate the maximum traffic among the traffic for the nodes included in the traffic distribution graph as the static variable, and calculate the correlation for at least two consecutive traffic distribution graphs over time as the dynamic variable. Can be.

Here, when abnormal traffic is detected, the processor may determine a type of abnormal traffic by applying a graph matching algorithm.

According to the present invention, by detecting abnormal traffic based on the traffic distribution graph, abnormal traffic can be detected accurately and quickly.

In addition, since the type of abnormal traffic is determined by applying a graph matching algorithm only when abnormal traffic is detected, the time required to determine the type of abnormal traffic can be reduced as compared to the conventional method of applying the graph matching algorithm to all traffic. have.

1 is a flowchart illustrating an abnormal traffic detection method according to an embodiment of the present invention.
2 is a conceptual diagram illustrating a process of generating a traffic distribution graph.
3 is a conceptual diagram illustrating a traffic distribution graph.
4 is a conceptual diagram illustrating a relationship between a graph and a subgraph.
5 is a graph of an attack pattern against a network.
6 is a block diagram showing an apparatus for detecting abnormal traffic according to an embodiment of the present invention.
7 is a graph showing changes in static variables over time.
8 is a graph illustrating a change in dynamic variables over time.
9 is a graph illustrating a change of a packet over time.

While the invention is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail.

It should be understood, however, that the invention is not intended to be limited to the particular embodiments, but includes all modifications, equivalents, and alternatives falling within the spirit and scope of the invention.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as a second component, and similarly, the second component may also be referred to as a first component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

When a component is referred to as being "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that other components may be present in between. Should be. On the other hand, when an element is referred to as being "directly connected" or "directly connected" to another element, it should be understood that there are no other elements in between.

The terminology used in this application is used only to describe a specific embodiment and is not intended to limit the invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "having" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted in an ideal or overly formal sense unless explicitly defined in the present application Do not.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate the understanding of the present invention, the same reference numerals are used for the same constituent elements in the drawings and redundant explanations for the same constituent elements are omitted.

1 is a flowchart illustrating a method for detecting abnormal traffic according to an embodiment of the present invention, and FIG. 2 is a conceptual diagram illustrating a process of generating a traffic distribution graph (TDG).

Referring to FIG. 1, the traffic detection method may include generating a graph representing network traffic (S100), and calculating static and / or dynamic metrics based on the graph ( S200), and detecting abnormal traffic based on at least one of the static variable and the dynamic variable (S300), and determining the abnormal traffic type (S400).

Here, step S100 may include step S110, step S120, and step S130, and step S200 may include step S210 and step S220. Step S100, step S200, step S300, and step S400 may be performed by the abnormal traffic detection apparatus.

The abnormal traffic detection apparatus monitors the traffic occurring in the network and detects the network traffic 10 at predetermined time intervals (S110). At this time, the abnormal traffic detection apparatus detects the network traffic 10 at one minute intervals. Can be.

After detecting the network traffic 10, the apparatus for detecting abnormal traffic may generate flow information 20 based on the network traffic 10 (S120). The flow refers to a collection of related packets, and the abnormal traffic detection apparatus can generate the flow information 20 based on 5-Tuples (Src IP, Dst IP, Src Port, Dst Port, Protocol). have. Here, 'Src IP' means source IP (source Internet Protocol), 'Dst IP' means destination IP, 'Src Port' means source port, 'Dst Port' means destination port Means.

Since the packet having the same 5-Tuples information is generated by the same application, the abnormal traffic detection apparatus may generate the flow information 20 by classifying the packets having the same 5-Tuples information.

After generating the flow information 20, the abnormal traffic detection apparatus may generate a graph representing network traffic based on the flow information 20, and may generate the traffic distribution graph 40 as a graph (S130). .

The abnormal traffic detection apparatus may first generate the DOT format 30 based on the flow information 20, and the DOT format 30 may include a node and an edge connected to the node. Here, the node may mean a terminal having an IP address, the edge may mean a flow of packets around the node, and the edge may have directionality.

For example, when a packet is transmitted from node 1 to node 2, node 1 and node 2 are connected through the edge, and the direction of the edge is the direction from node 1 to node 2. Here, the edge connected to the node means the transmission of the packet, that is, the generation of traffic, so that the more edges connected to the node, the more traffic is generated to the node.

After generating the DOT format 30, the abnormal traffic detection apparatus may generate the traffic distribution graph 40 based on the DOT format 30. The traffic distribution graph 40 may include a plurality of nodes, and one node may be connected to a plurality of other nodes through a plurality of edges.

After generating the traffic variance graph, the abnormal traffic detection apparatus may generate an adjacency matrix based on the traffic variance graph (S220). Here, the neighbor matrix refers to a matrix for indicating whether a particular node included in the traffic distribution graph is connected to another node through an edge, that is, adjacent.

3 is a conceptual diagram illustrating a traffic distribution graph.

Referring to FIG. 3, since node 1 is connected to nodes 3 and 4 through an edge, a matrix for node 1 may be represented by (0, 0, 1, 1). Since node 2 is connected to node 3 through the edge, the matrix for node 2 can be represented by (0, 0, 1, 0). Since node 3 is connected to nodes 1, 2, and 4 through the edge, the matrix for node 3 may be represented by (1, 1, 0, 1). Since node 4 is connected to nodes 1 and 3 through the edge, the matrix for node 4 can be represented by (1, 0, 1, 0).

Here, each row and each column means its own node (i.e. row 1 is node 1, row 2 is node 2, row 3 is node 3, row 4 is node 4, column 1 is node 1, column 2 Nodes 2 and 3 are nodes 3 and 4 are nodes 4), and when one node is connected to another node through an edge, the corresponding portion of the adjacent matrix can be represented as '1', and one node is different. If you are not connected to a node, you can represent that portion of the adjacency matrix as '0' (for example, the values for 1 row and 2 columns of adjacency matrix when node 1 and node 2 are connected via edges). And the value for column 2, column 1, can be represented as '1', and if the node 2 and node 3 are not connected, the value for column 2, column 3, and column 3, column 2 of the adjacent matrix will be represented as '0'. Can be)

In the above-described method, when the adjacent matrix of the traffic variance graph shown in FIG. 3 is calculated, it may be expressed as Equation 1 below.

After calculating the neighbor matrix based on the traffic variance graph, the abnormal traffic detection apparatus may calculate a static variable and / or a dynamic variable based on the neighbor matrix (S220). Static variables can represent traffic characteristics at a specific point in time. Static variables can be defined as' node degree ',' input order (Vin) ',' output order (Vout) ',' input / output order (Vino) ',' Maximum degree (Kmax) ',' entropy of the degree distribution ', and the like.

Here, 'node order' refers to the number of edges connected to the node, 'input order' refers to the number of edges representing packets coming into the node among the edges connected to the node, and 'output order' refers to the number of edges connected to the node. The number of edges representing the outgoing packets from the node, and 'input and output order' means the number of edges representing packets coming into the node of the edge connected to the node plus the number of edges representing the packets leaving the node.

'Maximum order' means 'node order' having the maximum value among 'node order' for all nodes included in the traffic distribution graph. That is, since the edge connected to the node means traffic to the node, 'maximum order' means the maximum traffic among all the nodes for all nodes included in the traffic distribution graph.

'Entropy of order variance' can be expressed as Equation 2 below.

Here, P (k) means the probability that 'node order' of the node is ' k ', and 'H (X)' means 'entropy of order variance'.

The abnormal traffic detection apparatus may detect abnormal traffic using at least one of 'node order', 'input order', 'output order', 'input and output order', 'maximum order' and 'entropy of order distribution'.

Dynamic variables represent traffic characteristics that change over time, and dynamic variables such as 'dk-0', 'dk-1', 'dk-2', and 'dk-2 distance' may be used. Where 'dk-0' is the average value of 'node order' for all nodes included in the traffic distribution graph, and 'dk-1' is the P (k) indicating the probability that the 'node order' of node is ' k ' (See Equation 2).

'dk-2' is the 'joint degree distribution' and indicates the distribution of edges connected to two adjacent nodes.

Referring to Figure 3, the common order (node 2, node 3) = (1, 3) (ie, the number of edges connected to node 2 is '1', the number of edges connected to node 3 is '3'), and the common order (Node 3, node 2) = (3, 1), common order (node 1, node 3) = (2, 3), common order (node 3, node 1) = (3, 2), common order (Node 1, node 4) = (2, 2), common order (node 4, node 1) = (2, 2), common order (node 4, node 3) = (2, 3), common Order (node 3, node 4) = (3, 2).

Here, (1, 3) is one, (2, 2) is two, (2, 3) is two, (3, 1) is one, and (3, 2) is two, so FIG. 3 The 'dk-2' matrix of the traffic variance graph shown in Equation 3 may be represented by Equation 3 below.

'dk-2 distance' represents the correlation of at least two consecutive traffic dispersion graphs over time, and the abnormal traffic detection apparatus uses the 'dk-2' for the traffic dispersion graph based on the Euclidean distance. 'Dk-2', which is the distance between 'and' dk-2 'for other traffic distribution graphs, can be calculated.

The abnormal traffic detection apparatus may detect abnormal traffic using at least one of 'dk-0', 'dk-1', 'dk-2', and 'dk-2 distance'.

After calculating the static variable and / or dynamic variable, the abnormal traffic detection apparatus may detect the abnormal traffic according to a result of comparing a predetermined threshold with at least one of the static variable and the dynamic variable ( S300). Here, the threshold value is a reference value for detecting abnormal traffic. The threshold value may be predefined by the user, and the threshold value for the static variable and the threshold value for the dynamic variable may be different from each other.

The abnormal traffic detection apparatus may determine the corresponding network traffic as abnormal traffic when at least one of the static variable and the dynamic variable is larger than a predefined threshold.

After detecting the abnormal traffic, the abnormal traffic detection apparatus may determine a type of the abnormal traffic by applying a graph matching algorithm (S400). The abnormal traffic detection apparatus may use a VF (Vento Foggia) algorithm as a graph matching algorithm, and the VF2 algorithm is an algorithm for determining equality between two graphs and may determine whether another graph is included in one graph.

4 is a conceptual diagram illustrating a relationship between a graph and a sub graph.

Referring to Figure 4, Figure 4 (a) is a traffic distribution graph consisting of Node A, Node B, Node C and Node D, Figure 4 (b) is Node A, Node B, Node C, Node D, Node E , Traffic distribution graph consisting of node F and node G. Here, the graph of FIG. 4 (a) is a subgraph of the graph of FIG. 4 (b).

When the VF2 algorithm is applied to the graph of FIG. 4 (a) and the graph of FIG. 4 (b), it can be seen that the graph of FIG. 4 (a) is included in the graph of FIG. 4 (b).

That is, the abnormal traffic detection apparatus applies the VF2 algorithm to the traffic distribution graph and the attack pattern graph for the network detected as abnormal traffic in step S300, so that the attack pattern graph for the network is included in the traffic distribution graph detected as the abnormal traffic. If the attack pattern graph for the network is included in the traffic distribution graph detected as abnormal traffic, the type of the abnormal traffic is determined as the traffic for the attack corresponding to the attack pattern graph for the network. can do.

5 is a graph of an attack pattern against a network.

Referring to FIG. 5, FIG. 5A is an attack pattern graph for host scanning. When the attack pattern graph of FIG. 5A is included in a traffic distribution graph detected as abnormal traffic, abnormal traffic is detected. The detection apparatus may determine the type of abnormal traffic by host scanning.

FIG. 5 (b) is an attack pattern graph for port scanning. When the attack pattern graph of FIG. 5 (b) is included in the traffic distribution graph detected as abnormal traffic, the abnormal traffic detection apparatus is configured to detect abnormal traffic. The type can be determined by port scanning.

FIG. 5 (c) is an attack pattern graph for a smurf. When the attack pattern graph of FIG. 5 (c) is included in a traffic distribution graph detected as abnormal traffic, the abnormal traffic detection apparatus identifies a type of abnormal traffic. Can be determined by smurf attacks.

FIG. 5 (d) is an attack pattern graph for a fragment, and when the attack pattern graph of FIG. 5 (d) is included in a traffic distribution graph detected as abnormal traffic, the abnormal traffic detection apparatus is a type of abnormal traffic. Can be determined as a fragment attack.

FIG. 5 (e) is an attack pattern graph for DNS name amplification. When the attack pattern graph of FIG. 5 (e) is included in a traffic distribution graph detected as abnormal traffic, the abnormal traffic detection apparatus is abnormal. The type of traffic can be determined by DNS amplification.

FIG. 5 (f) is an attack pattern graph for a distributed denial of service (DDoS). When the attack pattern graph of FIG. 5 (f) is included in a traffic distribution graph detected as abnormal traffic, the abnormal traffic detection apparatus is an abnormal traffic. The type of can be determined by DDos.

6 is a block diagram showing an apparatus for detecting abnormal traffic according to an embodiment of the present invention.

Referring to FIG. 6, the abnormal traffic detection apparatus 60 may include a processor 61 and a storage 62. The processor 61 may generate a traffic distribution graph representing network traffic, and calculate a static variable representing traffic characteristics at a specific time point and / or a dynamic variable representing traffic characteristics changing over time based on the traffic distribution graph. The abnormal traffic may be detected according to a result of comparing the at least one variable of the static variable and the dynamic variable with a predefined threshold value.

When calculating the dynamic variable, the processor 61 may calculate an adjacent matrix according to a connection relationship between nodes included in the traffic distribution graph, and calculate a static variable and / or a dynamic variable based on the adjacent matrix. .

The processor 61 may calculate the maximum traffic among the traffic to the node as a static variable, and calculate the correlation for at least two traffic variance graphs that are continuous over time as the dynamic variable.

When abnormal traffic is detected, the processor 61 may determine a type of abnormal traffic by applying a graph matching algorithm.

Here, the specific process of generating the traffic distribution graph by the processor 61 is the same as described in step S100, and the specific process of calculating the static variable and / or the dynamic variable is the same as described in step S200, and the threshold According to the comparison result, the specific process of detecting abnormal traffic is the same as described in step S300, and the specific process of determining the type of abnormal traffic is the same as described in step S400.

The function performed by the processor 61 may be substantially performed in a processor (eg, a central processing unit (CPU) and / or a graphics processing unit (GPU)).

The storage 62 may store at least one of a traffic distribution graph, a static variable, a dynamic variable, and a threshold value.

FIG. 7 is a graph showing a change in static variables over time, FIG. 8 is a graph showing a change in dynamic variables over time, and FIG. 9 is a graph showing a change in packets over time. That is, FIG. 7 is a graph showing a change in the maximum order Kmax with time, and FIG. 8 is a graph showing a change in the distance dk-2 with time.

7, 8, and 2 minutes, 22 minutes, 23 minutes, since the value of the 'maximum degree' and 'dk-2 distance' is suddenly changed, it can be easily confirmed that abnormal traffic occurred at the time. On the other hand, in the case of FIG. 9, since the difference between the abnormal traffic and the normal traffic is not large, it is not easy to detect the abnormal traffic.

The methods according to the present invention can be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention or may be available to those skilled in the computer software. Examples of computer readable media include hardware devices that are specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate with at least one software module to perform the operations of the present invention, and vice versa.

It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined in the appended claims. It will be possible.

60: abnormal traffic detection device
61:
62:

Claims (8)

In the abnormal traffic detection method performed in the device for detecting abnormal traffic,
Generating a graph representing network traffic;
Calculating a neighboring matrix according to a connection relationship between nodes included in the graph;
Calculating a static variable representing a traffic characteristic of a specific time point and a dynamic variable representing a traffic characteristic that changes with time based on the adjacent matrix; And
Detecting abnormal traffic according to a result of comparing the static variable and the dynamic variable with a predefined threshold value,
The calculating of the dynamic variable may include calculating the maximum traffic among the traffic for the node as the static variable, and calculating the correlation with at least two consecutive traffic distribution graphs over time as the dynamic variable. . The method according to claim 1, The abnormal traffic detection method,
And detecting abnormal traffic by applying a graph matching algorithm when abnormal traffic is detected. The method of claim 1, wherein generating the graph,
Abnormal traffic detection method for generating a traffic distribution graph (TDG) with the graph. delete delete Generate a Traffic Dispersion Graph (TDG) representing network traffic, calculate an adjacency matrix according to the connections between nodes included in the graph, and generate traffic characteristics at a specific time point based on the adjacency matrix A processor configured to calculate a static variable indicating a and a dynamic variable indicating a traffic characteristic changing with time, and detect abnormal traffic according to a result of comparing the static variable and the dynamic variable with a predefined threshold value; And
A storage unit for storing at least one of the traffic distribution graph, the static variable, the dynamic variable, and the threshold value,
The processing unit detects abnormal traffic that calculates the maximum traffic among the traffic to the nodes included in the traffic distribution graph as the static variable, and calculates the correlation of at least two traffic distribution graphs that are continuous over time as the dynamic variable. Device. delete The method according to claim 6, The processing unit,
When abnormal traffic is detected, the abnormal traffic detection apparatus for determining the type of abnormal traffic by applying a graph matching algorithm.

Images